Authorize.net setup

Updated Oct 17, 2026 Payments

Authorize.net is the gateway most often bundled with a merchant account from a bank or a traditional processor. In TitanCart the card form on your checkout page is Authorize.net’s own Accept.js field, so card numbers never touch your server; the charge is made when the order is placed — or, with Authorize Only, when you capture it from the order — and refunds go back through Authorize.net from the order.

Edition note: Authorize.net is a TitanCart Pro gateway. TitanCart Lite ships Stripe, Cash on Delivery, Bank Transfer and Check.

1. Get your credentials

Sandbox and production are two separate Authorize.net accounts with separate logins; for testing use a sandbox account. In the Merchant Interface:

Account → Account and API Settings: copy the API Login ID and generate a Transaction Key (generating a new one invalidates the old one).
On the same Account and API Settings page, under Public Client Key: create a Public Client Key. This is what the card form on your checkout page uses.
Optional: still on Account and API Settings, generate a Signature Key if you want Authorize.net to notify the store (the webhook, below).

2. Add Authorize.net in TitanCart

Go to Settings → Payment Gateways → + Add Payment Gateway.
On the General tab choose the Credit / Debit Card (Authorize.net) gateway, give it the name shoppers will see, an optional Description and Payment instructions, set Status to Active, save.
Reopen it; the Configure tab exists after the first save. Fill in:
- API Login ID, Transaction Key, Public Client Key — from step 1.
- Signature Key — optional; only needed for the webhook below.
- Sandbox / Test Mode — on by default; leave it on while testing.
- Transaction Type — Authorize & Capture (charge immediately), the default, charges the card as the order is placed. Authorize Only (capture later) reserves the funds and leaves the charge to you; see the note below.
Save and click Test Connection: “Authorize.net connection successful! You are connected to the SANDBOX environment (no real charges).”

Authorize Only. With Authorize Only (capture later) Authorize.net reserves the amount on the card and takes nothing. The order is placed On Hold with its stock reserved, the shopper is told their card has been authorised but not charged, and you get the usual new-order email. The money moves when you click Capture in the Payment panel on the order page, which also moves the order to Processing and sends the customer their confirmation; Void releases the hold and cancels the order instead. An authorisation that is not captured within 30 days expires, and TitanCart then cancels the order and returns its stock. The full walk-through is Capturing and voiding authorised payments. Stores still on TitanCart 0.2.44 or earlier should keep Authorize & Capture: those versions had no capture step and treated an authorisation as a payment.

One field that does nothing yet. Accepted Card Types is not read: the list is shown nowhere. You can fill it in; nothing changes.

Optional: let Authorize.net notify the store (the webhook)

Without this, TitanCart asks Authorize.net about open payments once an hour: a held-for-review payment you approve or decline, or a payment you capture or void in the Merchant Interface, reaches the order on the next check, and a refund made in the Merchant Interface is not reported back at all. With the webhook, all of those reach the order within seconds, and the refund is recorded on it. To set it up:

Paste the Signature Key from step 1 into the Configure tab and save.
Copy the Webhook URL the editor now shows (on the General tab and under the Configure fields): https://your-store.example/wp-json/titancart/v1/webhooks/authorize_net.
In the Merchant Interface go to Account → Account and API Settings → Webhooks Notifications → Create a webhook notification. Give it any name, paste the URL, set the status to Active, and tick these events: net.authorize.payment.fraud.approved, net.authorize.payment.fraud.declined, net.authorize.payment.fraud.held, net.authorize.payment.priorAuthCapture.created, net.authorize.payment.void.created, net.authorize.payment.refund.created. Save.

Every notification is checked against the Signature Key before anything happens; one that does not verify is refused, and one with no Signature Key saved on the gateway is refused too. The sandbox and production accounts are separate, so each needs its own endpoint and its own Signature Key — register it again when you go live.

A row with the Transaction Key empty shows a NEEDS SETUP pill in the gateway list and takes no payments.

3. Test with sandbox cards

On the storefront, add a product, go to checkout and choose the Authorize.net gateway; the card form appears on the page. The sandbox accepts Authorize.net’s published test cards:

4111 1111 1111 1111 — Visa
5424 0000 0000 0015 — Mastercard
3700 0000 0000 002 — American Express
6011 0000 0000 0012 — Discover
Expiry: any future date. Card code: any three or four digits. Postal code: any.

With Authorize & Capture, an approved card places the order as Processing, reduces stock, empties the cart, uses any coupon, issues any digital gift card and sends the confirmation and new-order emails. With Authorize Only the same card instead places the order On Hold with its stock reserved and the cart emptied, sends the shopper an “order received” email saying the card was authorised, sends you the new-order email, and waits for you to capture it — the coupon, gift card and confirmation follow the capture. A declined card shows the reason on the checkout page and nothing is placed.

If your account holds payments for review

Authorize.net’s fraud filters (Payments → Fraud Settings in the Merchant Interface) can hold a transaction for your review instead of approving or declining it, whichever Transaction Type you use. A held payment places the order On Hold with its stock reserved; the shopper is told the payment is being reviewed and that nothing has been charged, and the order page shows a Held for review at Authorize.net banner with a Void button but no Capture (Authorize.net would refuse one). Approve or reject the hold in the Merchant Interface under Payments → Manage Transactions → Suspicious Transactions; TitanCart asks Authorize.net about it once an hour (or hears within seconds, with the webhook above) and acts on the answer: approved under Authorize & Capture, the order completes itself (Processing, confirmation email); approved under Authorize Only, it becomes an ordinary authorisation and the Capture button appears; declined, the order is cancelled, the customer emailed and the stock returned. Details in Capturing and voiding authorised payments.

4. Switch to production

Sign in to your production Merchant Interface and repeat step 1 there: API Login ID, Transaction Key, Public Client Key. Sandbox credentials never work in production and vice versa.
In TitanCart replace the three values on the Configure tab, untick Sandbox / Test Mode, save.
Click Test Connection: it should now name the LIVE environment.
Place one small real order and refund it from the order (see the note on timing below).

5. Refunds and saved cards

Refunds — refund an order from Sales → Orders. Authorize.net only refunds a charge once it has settled (overnight, in batches). Before settlement TitanCart voids the charge instead, which is all-or-nothing: a partial refund on an unsettled charge is refused with a message saying to wait for settlement. A refund or void made in the Merchant Interface is reported back only when the webhook is set up: it then appears on the order’s Payment panel as a refund, and a full one moves the order to Refunded. Without the webhook it is not reported back.
Subscriptions — with the Subscriptions extension, the card is stored as an Authorize.net customer payment profile when the first payment is taken (at placement, or at Capture under Authorize Only) and renewals are charged against it. A subscription that starts later with nothing to pay today needs Stripe.
Not offered through this gateway: Apple Pay, Google Pay, PayPal-via-Authorize.net, eCheck.

How to verify on Authorize.net’s side

Every TitanCart charge reaches Authorize.net with your order number as the invoice number and the description “TitanCart order …”. In the Merchant Interface open Payments → Manage Transactions (the Settled or Unsettled tab) and search by invoice number, amount or date; the transaction detail shows the authorisation code, settlement status and any refund or void. On TitanCart’s side, the order page’s Payment panel lists the charge or authorisation, any refund or void, and the Authorize.net transaction ID for each, so you can search the Merchant Interface by that ID as well.

Troubleshooting

“User authentication failed due to invalid authentication values.” The API Login ID or Transaction Key is wrong, has a trailing space, or belongs to the other environment (sandbox keys with Sandbox / Test Mode off, or the reverse). Re-copy and run Test Connection.
The card form doesn’t appear at checkout. The API Login ID or Public Client Key is empty on the Configure tab, or the gateway is Disabled. The form is built from those two values.
The card form appears but submitting does nothing, or says the card could not be tokenised. The Public Client Key is invalid or was generated in the other environment. The browser console shows Accept.js’s exact error.
The gateway shows NEEDS SETUP. The Transaction Key is empty.
A refund failed with a settlement message. Wait for the nightly settlement, then refund; or refund the full amount now, which voids the charge.
Card orders arrive On Hold with an amber “Authorised … — not yet charged” banner. Transaction Type is on Authorize Only, and that is the feature working: capture or void each order from its Payment panel (Capturing and voiding authorised payments). Switch to Authorize & Capture if you would rather be paid at checkout.
An order arrived On Hold saying “Held for review”. One of your fraud filters held it. Approve or reject it under Payments → Manage Transactions → Suspicious Transactions in the Merchant Interface; the order completes or cancels itself within the hour of your decision, or within seconds if the webhook is set up.
I refunded or voided a payment in the Merchant Interface and the order didn’t change. Only the webhook reports those back. Set it up (section 2) for future ones; for this order, record the refund from the order page, or change its status by hand.
Authorize.net’s webhook page shows the endpoint failing. The Signature Key saved on the Configure tab must be the one from the same account (sandbox and production keys differ), and the URL must be exactly the one the editor shows. A notification that does not verify is answered with an error on purpose.
Orders placed before TitanCart 0.2.45 say Processing but the money never settled. Earlier versions treated an Authorize Only authorisation (or a held payment) as a payment. The Payment panel lists those transactions but offers no Capture for them: capture each one in the Merchant Interface before its 30 days run out, or ask the customer to pay again. Orders placed on 0.2.45 or later wait On Hold instead.